Free Practice Quiz Question List

3 Hashing, Password Storage, and Message Authentication Online Quiz Questions

Use this free practice quiz with 20 questions to review 3 Hashing, Password Storage, and Message Authentication, test your knowledge, and prepare for your next test or exam.

20 questions

Choose one

1 point

Which statement best describes a cryptographic hash function?

A
A digest is fixed-length and is not intended to be reversed to recover the input.
B
The digest is an encrypted version of the input that can be decrypted with a key.
C
The digest always reveals who created the input.
D
The digest has the same length as the input.

Fill in the blank

1 point

A cryptographic hash maps an input of practical length to a fixed-length output called a .

Written response

1 point

An attacker is given a digest and tries to find an input that produces it. What is this attack called?

Written response

1 point

An attacker tries to find any two different inputs that produce the same digest. What is this attack called?

True or false

1 point

True or false: If a system keeps a pepper secret and separate from its password database, it can use that pepper instead of generating a unique salt for each stored password verifier.

A
True
B
False

Choose one

1 point

A service is choosing how to store users' passwords. Which approach best limits the effectiveness of rapid guessing if its password database is stolen?

A
Use a fast general-purpose hash such as SHA-256 by itself, so login checks are quick.
B
Use a suitable, deliberately expensive password-hashing function with a unique random salt for each stored verifier.
C
Encrypt every password with a key stored in the same database, then compare encrypted values at login.
D
Use one fixed salt for every account and omit the KDF parameters.

Fill in the blank

1 point

At login, derive a new verifier from the submitted password using the stored and , then compare it with the stored verifier.

True or false

1 point

True or false: A unique salt prevents attackers from making password guesses against a particular account.

A
True
B
False

Choose all

1 point

Select all statements that correctly describe salts in password storage.

A
Use a unique random salt for each account and store it alongside the result.
B
A salt is not secret and may be stored with the password verifier.
C
With unique salts, identical passwords for two accounts produce different stored results.
D
A salt makes a weak password strong even if the password is guessed directly.
E
A salt stops all guesses against an individual account.

Written response

1 point

What is the widely used MAC construction built from a cryptographic hash function called?

Choose one

1 point

You download a file and want to use its hash to check whether it was changed. Which approach makes that integrity check meaningful if an attacker might control the download site?

A
Trust the digest posted beside the file on the same site, even if an attacker could replace both.
B
Compare the file's digest with an expected digest obtained through an independent trusted channel.
C
Encrypt the digest using the same public page that hosts the file.
D
Assume a matching digest proves who created the file.

Choose one

1 point

Alice and Bob share a secret key. An outside observer sees a valid MAC tag attached to a message they exchanged. What can the observer reasonably conclude from the MAC alone?

A
It proves to an outside observer that Alice, and not Bob, created the message.
B
It hides the message contents from anyone who can read the transmitted message.
C
It supports integrity and authentication between key holders, but does not by itself identify which key holder created the message to an outside observer.
D
It proves the message was unchanged and also encrypts it.

Choose all

1 point

A receiver is checking a message and its MAC. Select all appropriate actions or conclusions for this verification process.

A
Calculate the expected tag for the received message using the shared key.
B
Reject the message if the received tag does not match the expected tag.
C
Use a constant-time tag comparison where available.
D
Treat the MAC as encryption that conceals the message contents.
E
Calculate a valid expected tag without using the shared secret key.

Open ended

1 point

A small service is designing password storage and login verification. Describe the process it should use, explain why it is safer than storing a fast general-purpose hash, and state the role and limitation of an optional pepper.

Choose one

1 point

A service stores a file's cryptographic digest but not the file itself. Why can't the service use the digest to recover the original file?

A
Decrypt the digest using the hash function's key.
B
Use the hash function's one-way design: the digest is not meant to reveal the original input.
C
Ask the hash function to return the original input after verification.
D
Reverse the fixed-length digest to reconstruct the input.

Choose one

1 point

A team downloads a file and its digest from the same untrusted site. The site could have been altered by an attacker. Why is the digest alone not enough to establish that the file is unchanged?

A
A digest always identifies who created the file, even if it is replaced.
B
A digest detects changes only when it is encrypted with the file.
C
An attacker who can replace both the file and its digest can calculate a matching new digest.
D
A digest prevents anyone from editing the file.

Choose one

1 point

An analyst tries to find any pair of different files that have the same cryptographic digest, without starting from a particular file. Which kind of attack is this?

A
Find any two different inputs that produce the same digest.
B
Given a digest, find an input that produces it.
C
Given an input, find a different input with the same digest.
D
Change an input while keeping its digest secret.

Written response

1 point

A system adds an additional secret to password verification and keeps it separately from the password database. What is this secret called?

Choose one

1 point

A service is designing password storage. Which plan best reduces the risk of rapid offline password guessing while allowing the service to verify logins later?

A
Store the password encrypted with a key saved in the same database.
B
Hash every password with fast SHA-256 and use one shared salt for all accounts.
C
Use a suitable password-hashing KDF with a unique random salt, and store the algorithm and parameters, salt, and verifier.
D
Use a different fast general-purpose hash for each account, without storing its parameters.

True or false

1 point

A system that checks message authentication code tags should use a constant-time comparison where available to reduce the risk of leaking information through timing differences.

A
True
B
False